WordPress Plugin Vulnerabilities

MW WP Form < 4.4.3 - Unauthenticated Path Traversal

Description

The plugin does not validate file path, allowing unauthenticated users to upload files to arbitrary location

Affects Plugins

Plugin icon
mw-wp-form
Fixed in 4.4.3

References

CVE
CVE-2023-28408
CVE
CVE-2023-28409
URL
https://jvn.jp/en/jp/JVN01093915/

Classification

Type
TRAVERSAL
OWASP top 10
A1: Injection
CWE
CWE-22
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Taizoh Tsukamoto & Shuya Ota of Mitsui Bussan Secure Directions, Inc
Verified
No
WPVDB ID
5592c9f5-9aa3-4dfd-bfdc-eb613504a775

Timeline

Publicly Published
2023-05-15 (about 2 years ago)
Added
2023-05-16 (about 2 years ago)
Last Updated
2023-05-16 (about 2 years ago)

Other

Published
Title
Published
2022-03-01
Title
WordPress File Upload < 4.16.3 - Contributor+ Path Traversal to RCE
Published
2022-11-29
Title
Simple:Press < 6.8.1 - Admin+ Arbitrary File Update
Published
2019-01-25
Title
Download Ad Manager by WD - Arbitrary File Download
Published
2022-06-06
Title
Product Configurator for WooCommerce < 1.2.32 - Unauthenticated Arbitrary File Deletion
Published
2021-12-01
Title
CAOS < 4.1.9 - Admin+ Arbitrary Folder Deletion via Path Traversal